Ledger has extended Ledger Wallet to the Canton Network. Users can hold and transact Canton Coin through the device and interface they already use, while the keys authorising those transactions remain on the Ledger device.
The integration uses multi-hosted validators for security and redundancy. Ledger operates one, while Kiln operates the second under a co-validation arrangement. Both validators host the same wallets, and both must confirm a transaction before the network accepts the resulting state.
Validator infrastructure for institutional wallets needs to be designed around institutional requirements, not provider convenience. Formal key ceremonies, air-gapped procedures, and contractual recovery paths—this is how Ledger Enterprise delivers for institutions with even the most stringent requirements
Sebastien Badault, EVP of Enterprise, Ledger
For Kiln, the deployment involved building and operating the validator to Ledger's requirements for key generation, custody, recovery and contractual exit.
Canton changes the infrastructure model
Canton differs from public blockchains such as Ethereum and Solana. There is no single public transaction history that every node replays. Participants operate their own nodes, with the validator maintaining the transactions relevant to the parties it hosts. Supporting Canton means deciding where wallet state is hosted, who operates that infrastructure, and how the relationship can be unwound if the infrastructure provider changes.
The co-validation model gives Ledger two separately operated validators hosting the same wallets. A transaction requires confirmation from both, while balance reads can fail over between them. Both validators therefore need to be available for a transaction to complete.
Security and operational requirements
Ledger defined two requirements for the validator operated by Kiln:
- Identity keys generated through a documented, auditable procedure that Ledger's security team could review.
- A recovery path that gives Ledger access to the key material and validator state if Kiln experiences a disaster or the contract ends.
Both requirements were agreed with Kiln before launch and are documented in the contract rather than left as operational commitments.
The recovery requirement is particularly relevant to Canton. A party hosted on a validator cannot currently be moved to another validator while remaining online. Changing infrastructure providers therefore requires a defined recovery process rather than a conventional live migration.
Ledger wanted that process established before the validator went into production.
Kiln has operated staking infrastructure for Ledger across several proof-of-stake networks. The Canton deployment extends that relationship to infrastructure supporting a live consumer wallet.
Ledger's requirements focused on independent recovery and operational control. Working closely with the Digital Asset and Canton Network teams, we designed the deployment around those requirements from the beginning.
Ernest Oppetit, Co-founder and CPO of Kiln
Key generation and custody
The validator identity keys were generated during a formal ceremony, on an air-gapped machine booted from a purpose-built read-only image.
The ceremony followed a written standard operating procedure with named roles, dual control and full command logging.
A Canton validator identity consists of three keys: a namespace signing key, a protocol signing key and a protocol encryption key. All three were wrapped under an AES-256 master key, which was then split into three Shamir shares with a two-of-three recovery threshold. The shares went to separate physical locations, including two bank vaults, with a paper backup.
The key material stayed within the air-gapped environment in plaintext. The wrapped keys were imported into hardware-backed key management without exposing the material to the operator running the import, then verified against a digest generated during the ceremony.
Reconstructing the master key requires at least two of the three shares, which are held separately.
Recovery and contractual exit
The same ceremony produced the material required for the recovery process.
Kiln holds the key shares in separate locations. On a defined trigger, including a disaster or security incident affecting Kiln's infrastructure or termination of the contract, the shares can be transferred to Ledger, encrypted to a named list of Ledger recipients.
Kiln exports the validator database to secure storage controlled by Ledger. Ledger therefore holds a daily copy of the validator state that Canton wallets in the Ledger Wallet™ app rely on, independently of Kiln's infrastructure."
Both parts of the recovery process were established before the validator carried user funds, rather than being assembled at the point of failure.
About Ledger
Founded in 2014, LEDGER™ is the global leader in digital asset security for individuals and institutions. Ledger Wallet™, the all-in-one crypto app, offers a complete, secure platform where users can securely buy, sell, swap, spend, and earn rewards with their crypto*, secured by the iconic Ledger signers. With more than 8 million signers sold in 165+ countries and 10+ languages, Ledger is the trusted solution for individuals to exercise digital ownership, portfolio management, and control.
About Kiln
Kiln is an institutional onchain asset and yield management platform. Kiln crossed $18 billion in assets delegated across proof-of-stake networks in 2025 and now supports infrastructure across 30+ networks. Kiln provides infrastructure and software for custodians, wallets and asset managers, covering validator operations, staking, onchain yield and real-time reporting. Kiln has completed a SOC 2 Type II examination.
* Buy, sell, swap, stake or any other crypto transaction services are provided by third-party service providers. Ledger provides no advice or recommendations to use any of these third-party services. Rewards are not guaranteed. Ledger does not provide any financial advice or recommendation. The trademarks mentioned in this document are the sole property of Ledger. Canton, Canton Network and Canton Coin are trademarks of their respective owners.
About Kiln
Kiln is the leading staking and digital asset rewards management platform, enabling institutional customers to earn rewards on their digital assets, or to whitelabel earning functionality into their products. Kiln runs validators on all major PoS blockchains, with over $11 billion in crypto assets being programmatically staked and running over 5% of the Ethereum network on a multi-client, multi-cloud, and multi-region infrastructure. Kiln also provides a validator-agnostic suite of products for fully automated deployment of validators and reporting and commission management, enabling custodians, wallets, and exchanges to streamline staking or DeFi operations across providers. Kiln is SOC2 Type 2 certified.
.png)
